banananetwork
/
roundcubemail
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix missing CSRF token in message download (#6621)

Browse Source
pull/6841/head
Mario Harjac 6 years ago committed by Aleksander Machniak
parent 52d80f2467
commit d87d628601
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File

6
program/steps/mail/func.inc
Unescape Escape View File

@ -1250,6 +1250,7 @@ function rcmail_message_body($attrib)
$safe_mode = $MESSAGE->is_safe || intval($_GET['_safe']); $safe_mode = $MESSAGE->is_safe || intval($_GET['_safe']);
$out = ''; $out = '';
$part_no = 0; $part_no = 0;
$token = $RCMAIL->get_request_token();
$header_attrib = array(); $header_attrib = array();
foreach ($attrib as $attr => $value) { foreach ($attrib as $attr => $value) {
@ -1283,12 +1284,11 @@ function rcmail_message_body($attrib)
else if (!$part->size) { else if (!$part->size) {
continue; continue;
} }
// Check if we have enough memory to handle the message in it // Check if we have enough memory to handle the message in it
// #1487424: we need up to 10x more memory than the body // #1487424: we need up to 10x more memory than the body
else if (!rcube_utils::mem_check($part->size * 10)) { else if (!rcube_utils::mem_check($part->size * 10)) {
$out .= html::span('part-notice', $RCMAIL->gettext('messagetoobig'). ' ' $out .= html::span('part-notice', $RCMAIL->gettext('messagetoobig'). ' '
. html::a('?_task=mail&_action=get&_download=1&_uid='.$MESSAGE->uid.'&_part='.$part->mime_id . html::a('?_task=mail&_action=get&_download=1&_uid='.$MESSAGE->uid.'&_part='.$part->mime_id.'&_token='.$token
.'&_mbox='. urlencode($MESSAGE->folder), $RCMAIL->gettext('download'))); .'&_mbox='. urlencode($MESSAGE->folder), $RCMAIL->gettext('download')));
continue; continue;
} }
@ -1333,7 +1333,7 @@ function rcmail_message_body($attrib)
// #1487424: we need up to 10x more memory than the body // #1487424: we need up to 10x more memory than the body
if (!rcube_utils::mem_check(strlen($MESSAGE->body) * 10)) { if (!rcube_utils::mem_check(strlen($MESSAGE->body) * 10)) {
$out .= html::span('part-notice', $RCMAIL->gettext('messagetoobig'). ' ' $out .= html::span('part-notice', $RCMAIL->gettext('messagetoobig'). ' '
. html::a('?_task=mail&_action=get&_download=1&_uid='.$MESSAGE->uid.'&_part=0' . html::a('?_task=mail&_action=get&_download=1&_uid='.$MESSAGE->uid.'&_part=0&_token='.$token
.'&_mbox='. urlencode($MESSAGE->folder), $RCMAIL->gettext('download'))); .'&_mbox='. urlencode($MESSAGE->folder), $RCMAIL->gettext('download')));
} }
else { else {

Write Preview
Loading…
Cancel
Save